12 MAY 95
FM AMEMBASSY MOSCOW
SUBJECT: PRESIDENTIAL DECREE ON DATA ENCRYPTION:
FEDERAL AGENCY FOR GOVERNMENT COMMUNICATIONS AND
INFORMATION (FAPSI) GIVEN NEW POWERS
-------
SUMMARY
-------
1. A NEW PRESIDENTIAL DECREE ON DATA ENCRYPTION,
DECREE NO. 334 ISSUED APRIL 3, DECLARES ILLEGAL ANY
ENCRYPTION SOFTWARE OR HARDWARE DEVICE NOT APPROVED BY
THE FEDERAL AGENCY FOR GOVERNMENT COMMUNICATIONS AND
INFORMATION (FAPSI). THE DECREE PLACES ON FAPSI
WORRYING NEW POWERS OF CONTROLLING THE APPROVAL OF ALL
ENCRYPTION EQUIPMENT USED IN RUSSIA IN THE NAME OF
NATIONAL SECURITY AND INTENSIFYING THE STRUGGLE
AGAINST ORGANIZED CRIME. WHILE IT IS AT PRESENT
DIFFICULT TO SAY EXACTLY WHAT METHODS OF ENCRYPTION
FAPSI WILL AUTHORIZE, THE DECREE, NEVERTHELESS,
IMMEDIATELY INSTRUCTS:
-- ALL COMMERCIAL BANKS TO CONFORM TO THE DECREE IN
THEIR DEALINGS WITH THE CENTRAL BANK OF RUSSIA; AND
-- THE RUSSIAN FEDERATION CUSTOMS COMMITTEE TO BAN
THE IMPORT OF "ENCRYPTION FACILITIES" THAT LACK A
FAPSI APPROVED LICENSE.
THE DECREE ALSO STIPULATES CREATING A FEDERAL CENTER
FOR PROTECTION OF ECONOMIC INFORMATION AT FAPSI WITHIN
TWO MONTHS. LOCAL DATA NETWORKS, HOWEVER, ARGUE THAT
IT WOULD BE IMPOSSIBLE TO GUARANTEE CUSTOMERS ABSOLUTE
DATA SECURITY, GIVEN THE FACT THAT FAPSI WAS FORMERLY
A DEPARTMENT OF THE KGB. AN UNOFFICIAL ENGLISH
TRANSLATION OF THE DECREE FOLLOWS IN PARA THREE. END
SUMMARY.
----------------------------
LOCAL RESPONSE TO THE DECREE
----------------------------
2. MANY PRESIDENTIAL DECREES HAVE BEEN ISSUED SINCE
1992, BUT IMPLEMENTATION IS A DIFFERENT STORY. STILL
MANY LOCAL DATA NETWORK COMPANIES BELIEVE THAT THE
DECREE RAISES SOME VERY DISTURBING QUESTIONS. THEIR
MAIN CONCERNS:
-- LACK OF GUARANTEE FOR CONFIDENTIALITY: ALTHOUGH
PARA 8 OF THE DECREE MANDATES CREATION OF A FEDERAL
CENTER CHARGED WITH DEVELOPMENT AND IMPLEMENTATION OF
OVERALL PROGRAMS FOR ASSURING THE SAFETY OF THE
ECONOMIC INFORMATION OF RUSSIA'S CREDIT AND FINANCIAL
ORGANIZATIONS AND OTHER ECONOMICALLY SIGNIFICANT
INSTITUTIONS, FEW IN RUSSIA FEEL COMFORTABLE ABOUT
THIS DECREE, GIVEN WIDESPREAD BELIEF THAT GOVERNMENT
DATA HAVE FALLEN INTO THE HANDS OF CRIMINALS, NOT TO
MENTION POSSIBLE "BACKDOOR" DECODING BY LAW-
ENFORCEMENT BODIES THEMSELVES.
-- SOFTWARE DEVELOPMENT DONE IN RUSSIA BY FOREIGN
COMPANIES WOULD BECOME MUCH LESS ATTRACTIVE SINCE NONE
WOULD BE ABLE TO TRANSFER SOURCE CODES AND RETAIN
CONFIDENCE IN THEIR SECURITY.
-- SOME OF THE LOCAL CRITICS ARGUE EVEN FURTHER THAT
THE DECREE SENDS A SIGNAL TO THE WORLD COMPUTER
SOFTWARE INDUSTRY THAT THE RUSSIAN GOVERNMENT PLANS TO
MAKE THE PROTECTION OF A COMPANY'S OWN INTELLECTUAL
PROPERTY ITS BUSINESS.
----------------------------------------
ENGLISH TRANSLATION OF THE DECREE NO.334
----------------------------------------
3. ON MEASURES TO OBSERVE LEGALITY IN THE AREA OF
DEVELOPMENT, PRODUCTION, IMPLEMENTATION AND OPERATION
OF ENCRYPTION FACILITIES, AS WELL AS PROVISION OF
SERVICES IN THE AREA OF DATA ENCRYPTION APRIL 3, 1995,
#334
FOR THE PURPOSE OF ASSURING DEFINITE COMPLIANCE WITH
THE RUSSIAN FEDERATION LAW "ON FEDERAL STRUCTURES OF
GOVERNMENT COMMUNICATION AND INFORMATION", AS WELL AS
INTENSIFYING THE STRUGGLE AGAINST ORGANIZED CRIME AND
INCREASING THE SECURITY OF THE INFORMATION AND
TELECOMMUNICATION SYSTEMS USED BY STATE BODIES,
RUSSIA'S CREDIT AND FINANCIAL STRUCTURES, ENTERPRISES
AND ORGANIZATIONS, I DECREE:
-- 1. THE PROGRAM OF CREATION AND DEVELOPMENT OF THE
SPECIAL-PURPOSE INFORMATION AND TELECOMMUNICATIONS
SYSTEM IN THE INTEREST OF STATE BODIES IS TO BE GIVEN
THE STATUS OF PRESIDENTIAL PROGRAM. THE CENTER FOR
PRESIDENTIAL PROGRAMS OF THE ADMINISTRATION OF THE
PRESIDENT OF THE RUSSIAN FEDERATION TOGETHER WITH THE
FEDERAL AGENCY FOR GOVERNMENTAL COMMUNICATIONS AND
INFORMATION OF THE PRESIDENT OF THE RUSSIAN FEDERATION
ARE TO ENSURE ITS UPDATING AND IMPLEMENTATION.
-- 2. PROHIBIT THE USE OF ENCRYPTION FACILITIES IN
INFORMATION AND TELECOMMUNICATIONS SYSTEMS BY STATE
ORGANIZATIONS AND ENTERPRISES, INCLUDING CRYPTOGRAPHIC
FACILITIES FOR ENSURING INFORMATION AUTHENTICITY
(DIGITAL SIGNATURE), AND SHIELDED EQUIPMENT FOR
INFORMATION STORAGE, PROCESSING AND TRANSMISSION,
UNLESS SUCH FACILITIES HAVE A CERTIFICATE OF THE
FEDERAL AGENCY FOR GOVERNMENT COMMUNICATIONS AND
INFORMATION OF THE PRESIDENT OF THE RUSSIAN
FEDERATION, AS WELL AS PROHIBIT THE PLACEMENT OF STATE
ORDERS WITH ENTERPRISES AND ORGANIZATIONS USING SUCH
EQUIPMENT AND ENCRYPTION FACILITIES NOT HAVING A
CERTIFICATE OF THE FEDERAL AGENCY FOR GOVERNMENT
COMMUNICATIONS AND INFORMATION OF THE PRESIDENT OF THE
RUSSIAN FEDERATION.
-- 3. REQUIRE THE CENTRAL BANK OF THE RUSSIAN
FEDERATION AND THE FEDERAL AGENCY FOR GOVERNMENT
COMMUNICATIONS AND INFORMATION OF THE PRESIDENT OF THE
RUSSIAN FEDERATION TO TAKE THE NECESSARY MEASURES
AGAINST THE COMMERCIAL BANKS OF THE RUSSIAN FEDERATION
THAT EVADE THE REQUIRED USE OF SHIELDED EQUIPMENT FOR
INFORMATION STORAGE, PROCESSING AND TRANSMISSION
HAVING A CERTIFICATE OF THE FEDERAL AGENCY FOR
GOVERNMENT COMMUNICATIONS AND INFORMATION OF THE
PRESIDENT OF THE RUSSIAN FEDERATION DURING THEIR
INFORMATION EXCHANGES WITH DIVISIONS OF THE CENTRAL
BANK OF THE RUSSIAN FEDERATION.
-- 4. IN THE INTERESTS OF THE INFORMATION SECURITY
OF THE RUSSIAN FEDERATION AND INTENSIFYING THE
STRUGGLE AGAINST ORGANIZED CRIME, PROHIBIT LEGAL AND
PHYSICAL PERSONS FROM THE ACTIVITIES CONNECTED TO THE
DEVELOPMENT, PRODUCTION, IMPLEMENTATION AND OPERATIONS
OF ENCRYPTION FACILITIES, AS WELL AS SHIELDED
EQUIPMENT FOR INFORMATION STORAGE, PROCESSING AND
TRANSMISSION, WITHOUT LICENSES ISSUED BY THE FEDERAL
AGENCY FOR GOVERNMENT COMMUNICATIONS AND INFORMATION
OF THE PRESIDENT OF THE RUSSIAN FEDERATION IN
ACCORDANCE WITH THE RUSSIAN FEDERATION LAW "ON FEDERAL
STRUCTURES OF GOVERNMENT COMMUNICATION AND
INFORMATION".
-- 5. THE STATE CUSTOMS COMMITTEE OF THE RUSSIAN
FEDERATION IS TO TAKE MEASURES FOR BANNING THE
IMPORTATION OF TO THE TERRITORY OF THE RUSSIAN
FEDERATION OF ENCRYPTION FACILITIES MANUFACTURED
ABROAD WITHOUT A LICENSE OF THE MINISTRY OF EXTERNAL
ECONOMIC RELATIONS OF THE RUSSIAN FEDERATION ISSUED IN
COORDINATION WITH THE FEDERAL AGENCY FOR GOVERNMENT
COMMUNICATIONS AND INFORMATION OF THE PRESIDENT OF THE
RUSSIAN FEDERATION.
-- 6. THE FEDERAL COUNTERINTELLIGENCE SERVICE OF THE
RUSSIAN FEDERATION AND THE MINISTRY OF INTERNAL
AFFAIRS OF THE RUSSIAN FEDERATION TOGETHER WITH THE
FEDERAL AGENCY FOR GOVERNMENT COMMUNICATIONS AND
INFORMATION OF THE PRESIDENT OF THE RUSSIAN
FEDERATION, THE STATE TAXATION SERVICE OF THE RUSSIAN
FEDERATION, AND THE DEPARTMENT OF TAXATION POLICE OF
THE RUSSIAN FEDERATION IMPLEMENT THE IDENTIFICATION OF
THE LEGAL AND PHYSICAL PERSONS VIOLATING THE
REQUIREMENTS OF THE DECREE.
-- 7. REQUIRE THE PROSECUTOR GENERAL OF THE RUSSIAN
FEDERATION TO STRENGTHEN THE ENFORCEMENT OF COMPLIANCE
WITH THE RUSSIAN FEDERATION LAW "ON FEDERAL STRUCTURES
OF GOVERNMENT COMMUNICATIONS AND INFORMATION" WITH
RESPECT TO THE DEVELOPMENT, PRODUCTION, IMPLEMENTATION
AND USE OF ENCRYPTION FACILITIES, AS WELL AS TO THE
PROVISION OF SERVICES IN THE AREA OF DATA ENCRYPTION
IN THE RUSSIAN FEDERATION THAT ARE SUBJECT TO
LICENSING AND CERTIFICATION BY THE FEDERAL AGENCY FOR
GOVERNMENT COMMUNICATIONS AND INFORMATION OF THE
PRESIDENT OF THE RUSSIAN FEDERATION.
-- 8. CREATE THE FEDERAL CENTER FOR PROTECTION OF
ECONOMIC INFORMATION OF THE FEDERAL AGENCY FOR
GOVERNMENT COMMUNICATIONS AND INFORMATION OF THE
PRESIDENT OF THE RUSSIAN FEDERATION (WITHIN THE
AGENCY'S STAFF), CHARGING IT WITH THE DEVELOPMENT AND
IMPLEMENTATION OF OVERALL PROGRAMS FOR ASSURING THE
SAFETY OF THE ECONOMIC INFORMATION OF RUSSIA'S CREDIT
AND FINANCIAL AND OTHER ECONOMICALLY SIGNIFICANT
STRUCTURES OF THE COUNTRY.
THE GENERAL DIRECTOR OF THE FEDERAL AGENCY FOR
GOVERNMENT COMMUNICATIONS AND INFORMATION OF THE
PRESIDENT OF THE RUSSIAN FEDERATION IS TO APPROVE A
CHARTER OF THE SAID CENTER WITHIN 2 MONTHS.
-- 9. THE DECREE IS IN FORCE FROM THE DAY OF ITS
PUBLICATION.
PRESIDENT OF THE RUSSIAN FEDERATION
B. YELTSIN